CN113538130A - Abnormity detection method, device and system - Google Patents

Abnormity detection method, device and system Download PDF

Info

Publication number
CN113538130A
CN113538130A CN202110830113.4A CN202110830113A CN113538130A CN 113538130 A CN113538130 A CN 113538130A CN 202110830113 A CN202110830113 A CN 202110830113A CN 113538130 A CN113538130 A CN 113538130A
Authority
CN
China
Prior art keywords
item
detected
data
detection
abnormal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202110830113.4A
Other languages
Chinese (zh)
Other versions
CN113538130B (en
Inventor
钟添羽
周凌霄
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zhejiang eCommerce Bank Co Ltd
Original Assignee
Zhejiang eCommerce Bank Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zhejiang eCommerce Bank Co Ltd filed Critical Zhejiang eCommerce Bank Co Ltd
Priority to CN202110830113.4A priority Critical patent/CN113538130B/en
Publication of CN113538130A publication Critical patent/CN113538130A/en
Application granted granted Critical
Publication of CN113538130B publication Critical patent/CN113538130B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/03—Credit; Loans; Processing thereof
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/10—Office automation; Time management
    • G06Q10/103—Workflow collaboration or project management

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Strategic Management (AREA)
  • Human Resources & Organizations (AREA)
  • General Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Marketing (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Economics (AREA)
  • Physics & Mathematics (AREA)
  • Finance (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Technology Law (AREA)
  • Data Mining & Analysis (AREA)
  • Development Economics (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Tourism & Hospitality (AREA)
  • Debugging And Monitoring (AREA)

Abstract

The embodiment of the specification provides an abnormality detection method, an abnormality detection device and an abnormality detection system, wherein the abnormality detection method comprises the following steps: the method comprises the steps of obtaining item data of at least two dimensions related to an item to be detected, wherein each dimension comprises a plurality of sub-dimensions, combining the plurality of sub-dimensions of the at least two dimensions, taking a combined result as a dimension factor of the item to be detected, screening a target user related to the dimension factor according to the item data, obtaining data based on item resources of the target user, determining abnormal detection data of the target user, and determining an abnormal detection result of the item to be detected according to an abnormal detection rule corresponding to the item to be detected and the abnormal detection data.

Description

Abnormity detection method, device and system
Technical Field
The embodiment of the specification relates to the technical field of computers, in particular to an anomaly detection method. One or more embodiments of the present specification also relate to an abnormality detection apparatus, an abnormality detection system, a computing device, and a computer-readable storage medium.
Background
With the rapid development of the economy and the diversity of economic development ways, more and more financial instruments are produced, and many enterprises or users can loan from different financial instruments to relieve the short-term economic pressure.
Currently, the loan fund as an important component of the loan item of each financial institution often has a great influence on the cash flow of the financial institution. And daily loan units are important targets and decision references for daily management of financial institutions. However, financial institutions often have fluctuating loan amounts due to uncertainty in user behavior and market conditions. The identification of the fluctuation reasons is performed from multiple dimensions, which is helpful for better and more comprehensively understanding the root cause of the fluctuation so as to adjust the wind control strategy of the loan item, and therefore, an effective detection method is urgently needed to improve the accuracy of the analysis result of the abnormal fluctuation reasons.
Disclosure of Invention
In view of this, the embodiments of the present disclosure provide an abnormality detection method. One or more embodiments of the present disclosure also relate to an abnormality detection apparatus, an abnormality detection system, a computing device, and a computer-readable storage medium to address technical deficiencies in the prior art.
According to a first aspect of embodiments herein, there is provided an abnormality detection method including:
acquiring project data of at least two dimensions related to a project to be detected, wherein each dimension comprises a plurality of sub-dimensions;
combining a plurality of sub-dimensions under the at least two dimensions, and taking a combined result as a dimension factor of the item to be detected;
screening target users associated with the dimension factors according to the project data, acquiring data based on project resources of the target users, and determining abnormal detection data of the target users;
and determining an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
Optionally, the combining the multiple sub-dimensions of the at least two dimensions includes:
combining a plurality of sub-dimensions in any of the at least two dimensions; and/or the presence of a gas in the gas,
combining a plurality of sub-dimensions in any two or more of the at least two dimensions.
Optionally, the determining the abnormal detection data of the target user based on the project resource acquisition data of the target user includes:
determining a first difference value between the project resource acquisition data of the target user and a first resource value; and/or the presence of a gas in the gas,
determining a second difference value between the project resource acquisition data of the target user and a second resource value, and taking the first difference value and the second difference value as abnormal detection data of the target user;
the first resource value is a fixed resource value of the project to be detected, and the second resource value is an adjusted resource value generated based on the project data.
Optionally, the determining an abnormal detection result of the item to be detected according to the abnormal detection rule and the abnormal detection data corresponding to the item to be detected includes:
determining an abnormal detection rule corresponding to the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether a resource change value contained in the abnormal detection data is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
if so, determining that the item to be detected is abnormal, and taking the dimension factor as an abnormal detection result of the item to be detected.
Optionally, the determining an abnormal detection result of the item to be detected according to the abnormal detection rule and the abnormal detection data corresponding to the item to be detected includes:
determining a target resource value for carrying out anomaly detection according to the weights respectively corresponding to the first resource value and the second resource value;
determining an abnormal detection rule associated with the target resource value in the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether the target resource value is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
and if so, taking the dimension factor as an abnormal detection result of the item to be detected.
Optionally, the abnormality detecting method further includes:
receiving an abnormal detection instruction submitted by a user aiming at the detection index of the item to be detected;
performing anomaly detection on the detection index according to a target dimension factor of the detection index carried in the anomaly detection instruction;
and generating and displaying a corresponding abnormal detection result.
Optionally, before the acquiring the item data of at least two dimensions related to the item to be detected, the method further includes:
receiving a detection parameter configuration instruction submitted by a user aiming at the item to be detected, wherein the detection parameter configuration instruction comprises an abnormal detection time interval of the item to be detected;
polling and detecting whether the time difference between the current time and the historical abnormal detection time of the item to be detected is greater than or equal to the abnormal detection time interval or not according to a preset detection period;
and if so, executing the step of acquiring the project data of at least two dimensions related to the project to be detected.
Optionally, after determining the abnormal detection result of the item to be detected, the method further includes:
if the to-be-detected item is determined to be abnormal according to the abnormal detection result, determining a dimensionality factor associated with the abnormal detection result;
adding the dimension factor as a child dimension to the project data.
Optionally, after determining the abnormal detection result of the item to be detected, the method further includes:
and if the to-be-detected item is determined to be abnormal according to the abnormal detection result, acquiring data according to the item resource of the target user, and adjusting the resource allocation strategy of the target user.
According to a second aspect of embodiments herein, there is provided an abnormality detection apparatus including:
the system comprises an acquisition module, a display module and a display module, wherein the acquisition module is configured to acquire item data of at least two dimensions related to an item to be detected, and each dimension comprises a plurality of sub-dimensions;
the combination module is configured to combine the plurality of sub-dimensions under the at least two dimensions, and the combination result is used as a dimension factor of the item to be detected;
the screening module is configured to screen the target users related to the dimension factors according to the project data, acquire data based on project resources of the target users and determine abnormal detection data of the target users;
and the determining module is configured to determine an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
According to a third aspect of embodiments herein, there is provided an abnormality detection system including:
a data layer, an engine layer and an interaction layer;
the data layer is configured to acquire item data of at least two dimensions related to an item to be detected, wherein each dimension comprises a plurality of sub-dimensions;
the engine layer is configured to extract the item data from the data layer, combine a plurality of sub-dimensions under the at least two dimensions, use a combination result as a dimension factor of the item to be detected, screen a target user associated with the dimension factor according to the item data, acquire data based on item resources of the target user included in the item data, determine abnormal detection data of the target user, and determine a first detection result of the item to be detected according to an abnormal detection rule corresponding to the item to be detected and the abnormal detection data;
the interaction layer is configured to display the first detection result.
Optionally, the interaction layer is further configured to receive an anomaly detection instruction submitted by a user for a detection index of the item to be detected;
the engine layer is further configured to perform anomaly detection on the detection index according to a target dimension factor of the detection index carried in the anomaly detection instruction, and generate a second detection result;
the interaction layer is further configured to display the second detection result.
According to a fourth aspect of embodiments herein, there is provided a computing device comprising:
a memory and a processor;
the memory is to store computer-executable instructions, and the processor is to execute the computer-executable instructions to:
acquiring project data of at least two dimensions related to a project to be detected, wherein each dimension comprises a plurality of sub-dimensions;
combining a plurality of sub-dimensions under the at least two dimensions, and taking a combined result as a dimension factor of the item to be detected;
screening target users associated with the dimension factors according to the project data, acquiring data based on project resources of the target users, and determining abnormal detection data of the target users;
and determining an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
According to a fifth aspect of embodiments herein, there is provided a computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the anomaly detection method.
One embodiment of the present specification obtains item data of at least two dimensions related to an item to be detected, where each dimension includes a plurality of sub-dimensions, combines the plurality of sub-dimensions of the at least two dimensions, uses a combination result as a dimension factor of the item to be detected, screens a target user associated with the dimension factor according to the item data, obtains data based on an item resource of the target user, determines abnormality detection data of the target user, and determines an abnormality detection result of the item to be detected according to an abnormality detection rule corresponding to the item to be detected and the abnormality detection data.
The embodiment of the specification realizes dimension crossing by combining a plurality of sub-dimensions under at least two dimensions, screens a target user based on a dimension factor generated by the dimension crossing, and performs anomaly detection on a to-be-detected item according to item resource acquisition data of the target user, so that the dimension factor which is difficult to disclose according to expert experience is favorably mined, and an heuristic anomaly detection result (anomaly attribution analysis result) is generated, thereby further being favorable for improving the anomaly detection result of the to-be-detected item.
Drawings
FIG. 1 is a schematic diagram of an anomaly detection system provided by one embodiment of the present description;
FIG. 2 is a flow chart of a process for a method for anomaly detection provided by one embodiment of the present specification;
FIG. 3 is a flowchart illustrating a processing procedure of a method for detecting an anomaly according to an embodiment of the present disclosure;
FIG. 4 is a schematic diagram of an anomaly detection device provided in one embodiment of the present disclosure;
fig. 5 is a block diagram of a computing device according to an embodiment of the present disclosure.
Detailed Description
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present description. This description may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein, as those skilled in the art will be able to make and use the present disclosure without departing from the spirit and scope of the present disclosure.
The terminology used in the description of the one or more embodiments is for the purpose of describing the particular embodiments only and is not intended to be limiting of the description of the one or more embodiments. As used in one or more embodiments of the present specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used in one or more embodiments of the present specification refers to and encompasses any and all possible combinations of one or more of the associated listed items.
It will be understood that, although the terms first, second, etc. may be used herein in one or more embodiments to describe various information, these information should not be limited by these terms. These terms are only used to distinguish one type of information from another. For example, a first can also be referred to as a second and, similarly, a second can also be referred to as a first without departing from the scope of one or more embodiments of the present description. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.
In the present specification, an abnormality detection method is provided, and the present specification relates to an abnormality detection apparatus, an abnormality detection system, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.
The existing analysis method is usually based on manual operation, and project personnel selects potential factors (such as suddenly more borrowed people, whether large-scale activity promotion activities exist, and the like) which possibly cause changes according to expert experience, analyzes indexes which change through manual data acquisition, and further calculates the influence on balance fluctuation.
The disadvantages are as follows:
1) the dimension is single. Due to the limitation of energy and time, the traditional method usually only selects a few key indexes for analysis, and usually researches the influence of single index change on balance change, and the cross multidimensional analysis is not many.
2) Lack of insight. The analysis depending on expert experience is often limited in the subjective cognition of the operator, and the analysis result usually only verifies that the operator considers the result to be correct, so that heuristic results beyond experience are difficult to give.
3) It cannot be automated. The manual data acquisition verification process is complicated, and the daily work of a project worker is influenced by the analysis process of too many repeated processes.
Based on this, an embodiment of the present specification provides an abnormality detection system, and a schematic diagram of a specific abnormality detection system is shown in fig. 1, including:
a data layer 102, an engine layer 104, and an interaction layer 106;
the data layer 102 is configured to obtain item data of at least two dimensions related to an item to be detected, wherein each dimension includes a plurality of sub-dimensions;
the engine layer 104 is configured to extract the item data from the data layer 102, combine multiple sub-dimensions under the at least two dimensions, use a combination result as a dimension factor of the item to be detected, screen a target user associated with the dimension factor according to the item data, acquire data based on an item resource of the target user included in the item data, determine abnormal detection data of the target user, and determine a first detection result of the item to be detected according to an abnormal detection rule corresponding to the item to be detected and the abnormal detection data;
the interaction layer 106 is configured to display the first detection result.
Optionally, the interaction layer 106 is further configured to receive an anomaly detection instruction submitted by a user for the detection index of the item to be detected;
the engine layer 104 is further configured to perform anomaly detection on the detection index according to a target dimension factor of the detection index carried in the anomaly detection instruction, and generate a second detection result;
the interaction layer 106 is further configured to display the second detection result.
Specifically, the items to be detected, that is, the items that need to be subjected to anomaly detection, include, but are not limited to, resource transaction items, resource loan items, claim settlement items, public welfare items, and the like.
In the embodiment of the present specification, the item to be detected is taken as a resource lending item as an example for explanation, and the at least two dimensions may include, but are not limited to, user attributes, user behaviors, item operations, item market changes, and the like.
In addition, each dimension includes multiple sub-dimensions, and taking the user attribute dimension as an example, the sub-dimensions included include, but are not limited to, a user address, a user occupation, and the like.
As shown in fig. 1, the anomaly detection system provided in the embodiment of the present disclosure includes a data layer 102, an engine layer 104, and an interaction layer 106; the method comprises the steps that firstly, the data layer 102 acquires and stores at least two-dimensional project data (user portrait, macro economy, project operation and other data) related to a project to be detected, the engine layer 104 extracts the data from the data layer 102, then dimension intersection is carried out on the extracted data, variation analysis is carried out on the dimension intersection result, root cause judgment is carried out on the project to be detected according to the variation analysis result, specifically, whether the project to be detected is abnormal or not is judged, and the reason of abnormality is caused under the condition that the project to be detected is abnormal or not is judged; after the root cause analysis result of the item to be detected is obtained, the root cause analysis result can be visually displayed through the interaction layer 106.
The core of the anomaly detection system provided by the embodiment of the specification is as follows: and combining and crossing the sub-dimensions based on the project data of the data layer 102, further judging the variation degree of the cross-generated dimension factor, and screening the dimension factor meeting the conditions as a potential abnormal root factor according to an abnormal detection rule set by the project to be detected.
Among them, the engine layer 104 can implement two modes:
1) automatically analyzing, wherein an algorithm engine can judge whether the project resource value of the project to be detected is abnormally changed through automatic scheduling, and further automatically analyzing the reason causing the abnormal change;
2) and customizing the project, wherein if the user determines that the project to be detected is abnormal, the interaction layer 106 can send an abnormal analysis instruction to the engine layer 104, so that the engine layer 104 performs abnormal analysis or automatic drill-down analysis according to an analysis path customized by the user.
In addition, the interaction layer is a user direct perception layer, daily detection of project resource values can be carried out on a productized interface, and an anomaly analysis instruction can be sent to the engine layer through the interaction layer. And the analysis results generated by actively or automatically carrying out the anomaly analysis by the engine layer are displayed to the user through the visual effect of the interaction layer.
The embodiment of the specification realizes dimension crossing by combining a plurality of sub-dimensions under at least two dimensions, screens a target user based on a dimension factor generated by the dimension crossing, and performs anomaly detection on a to-be-detected item according to item resource acquisition data of the target user, so that the dimension factor which is difficult to disclose according to expert experience is favorably mined, and an heuristic anomaly detection result (anomaly attribution analysis result) is generated, thereby further being favorable for improving the anomaly detection result of the to-be-detected item.
Fig. 2 shows a process flow diagram of an anomaly detection method provided in accordance with one embodiment of the present specification, including steps 202 through 208.
Step 202, acquiring item data of at least two dimensions related to the item to be detected, wherein each dimension comprises a plurality of sub-dimensions.
Specifically, the items to be detected, that is, the items that need to be subjected to anomaly detection, include, but are not limited to, resource transaction items, resource loan items, claim settlement items, public welfare items, and the like.
In the embodiment of the present specification, the item to be detected is taken as a resource lending item as an example for explanation, and the at least two dimensions may include, but are not limited to, user attributes, user behaviors, item operations, item market changes, and the like.
In addition, each dimension only includes a plurality of sub-dimensions, and taking the user attribute dimension as an example, the sub-dimensions included include, but are not limited to, a user address, a user occupation, and the like.
After the project data of at least two dimensions are obtained, the abnormal detection can be carried out on the project to be detected based on the project data. However, in practical applications, in order to ensure accuracy of an anomaly detection result and improve anomaly detection efficiency, in the embodiments of the present specification, before performing anomaly detection using item data, corresponding processing may be performed on the item data, for example, the item data may be cleaned to remove dirty data, and statistics may be performed on data of different sub-dimensions in the item data, including but not limited to statistics on a maximum value, a minimum value, and a mean value in the item data of the same sub-dimension.
In specific implementation, before acquiring the item data of at least two dimensions related to the item to be detected, the method further includes:
receiving a detection parameter configuration instruction submitted by a user aiming at the item to be detected, wherein the detection parameter configuration instruction comprises an abnormal detection time interval of the item to be detected;
polling and detecting whether the time difference between the current time and the historical abnormal detection time of the item to be detected is greater than or equal to the abnormal detection time interval or not according to a preset detection period;
and if so, acquiring at least two-dimensional project data related to the project to be detected.
Specifically, before the anomaly detection is performed on the item to be detected, whether the item to be detected or the related detection indexes of the item to be detected are abnormal or not can be actively analyzed; and if the item to be detected is abnormal, acquiring item data of at least two dimensions related to the item to be detected, and determining the abnormal reason of the item to be detected according to the item data.
In practical application, a user can set an automatic detection period of an item to be detected in a process that the anomaly detection platform configures detection parameters of the item to be detected, so that the anomaly detection platform can automatically perform anomaly detection on the item to be detected at regular time according to a certain period.
Therefore, after receiving a detection parameter configuration instruction submitted by a user for the item to be detected, the anomaly detection platform can query the detection period of the item to be detected, namely an anomaly detection time interval, from the detection parameter configuration instruction, and execute acquisition of item data of at least two dimensions related to the item to be detected to perform anomaly detection on the item to be detected when detecting that the time difference between the current time and the last anomaly detection time (historical anomaly detection time) of the item to be detected is greater than or equal to the anomaly detection time interval.
In practical application, the user can also manually trigger the abnormality detection process of the item to be detected in real time, and the abnormality detection process can be determined according to actual requirements without limitation.
In the embodiment of the present specification, by setting an anomaly detection period, that is, an anomaly detection time interval, of an item to be detected, when a time interval between the current time and the last anomaly detection time of the item to be detected is detected by an anomaly detection platform is greater than or equal to the anomaly detection time interval, an anomaly detection process can be automatically performed, so that time consumed for performing anomaly detection on the item to be detected is reduced, and detection efficiency is improved.
And 204, combining the multiple sub-dimensions under the at least two dimensions, and taking a combined result as a dimension factor of the item to be detected.
Specifically, after the item data of at least two dimensions related to the item to be detected is acquired, a plurality of sub-dimensions under the at least two dimensions can be combined, so that the combined result is used as a dimension factor to perform anomaly detection on the item to be detected.
Alternatively, before combining, data extraction can be performed according to a dimension or a sub-dimension given by a user, and the sub-dimensions covered by the extracted data are combined.
In specific implementation, combining the multiple sub-dimensions of the at least two dimensions includes:
combining a plurality of sub-dimensions in any of the at least two dimensions; and/or the presence of a gas in the gas,
combining a plurality of sub-dimensions in any two or more of the at least two dimensions.
Specifically, after the project data of at least two dimensions are acquired, the sub-dimensions in any one dimension may be combined, or the sub-dimensions in two or more dimensions may be combined.
Taking the item to be detected as a resource lending item as an example, the at least two dimensions include user attributes, user behaviors, item operations, item market changes, and the like.
Sub-dimensions under the user attribute dimension include, but are not limited to, user locations (city 1, city 2, city 3, etc.), user professions (teacher, white collar, creator, etc.), and the like; the sub-dimensions in the user behavior dimension include, but are not limited to, the number of resource acquisition times (resource lending times), the resource acquisition time, and the resource acquisition amount (resource lending amount) of the user.
Combining the plurality of sub-dimensions under the at least two dimensions can combine the male, the city 1 under the attribute dimension of the user, or can combine the resource acquisition limit of the male, the city 1 and the user.
The embodiment of the specification increases the diversity of the dimension factors by combining the sub-dimensions, and performs anomaly detection on the items to be detected through the dimension factors, thereby being beneficial to improving the accuracy of anomaly detection results.
Step 206, screening the target users associated with the dimension factors according to the project data, acquiring data based on the project resources of the target users, and determining abnormal detection data of the target users.
Specifically, after the multiple sub-dimensions under at least two dimensions are combined to obtain the dimension factor of the item to be detected, the target user associated with the dimension factor can be screened according to the item data, data is obtained according to the item resource of the target user, and the abnormal detection data of the user is determined.
Along the above example, if the dimension factor generated by combination includes male and city 1, then it is determined that 10 ten thousand people meet the condition of the dimension factor according to the project data, the 10 ten thousand people can be screened out as target users, then project resource acquisition data (resource acquisition quota) of the target users is determined from the project data, for example, resource acquisition quotas of last week and current week of the users can be determined, then changes of the resource acquisition quotas between two weeks are compared, and the comparison result is used as abnormal detection data of the target users (the change value of the resource acquisition quotas between two weeks can be used as abnormal detection data of the target users).
And 208, determining an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
Specifically, after the anomaly detection data of the target user is determined, the anomaly detection result of the item to be detected can be determined according to the anomaly detection rule corresponding to the item to be detected and the anomaly detection data.
In specific implementation, the abnormality detection result of the item to be detected is determined according to the abnormality detection rule and the abnormality detection data corresponding to the item to be detected, and the method can be specifically implemented in the following manner:
determining an abnormal detection rule corresponding to the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether a resource change value contained in the abnormal detection data is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
if so, determining that the item to be detected is abnormal, and taking the dimension factor as an abnormal detection result of the item to be detected.
Specifically, after the anomaly detection data of the user is determined, the anomaly detection data can be combined with the anomaly detection rule of the item to be detected, the item to be detected is subjected to anomaly detection, and a corresponding anomaly detection result is generated.
Specifically, an anomaly detection rule corresponding to the item to be detected is determined, an anomaly detection reference value corresponding to the anomaly detection rule is determined, whether a resource change value contained in the anomaly detection data is greater than or equal to the anomaly detection reference value is judged based on the anomaly detection rule, if yes, the item to be detected is determined to be abnormal, and the dimension factor is used as an anomaly detection result of the item to be detected.
In specific implementation, after the abnormal detection result of the item to be detected is determined, if the abnormal condition of the item to be detected is determined according to the abnormal detection result, data is acquired according to the item resource of the target user, and the resource allocation strategy of the target user is adjusted.
Specifically, after anomaly detection is performed on the item to be detected based on the dimension factor, and a corresponding anomaly detection result is generated, if the anomaly is determined according to the anomaly detection result, the cause of the anomaly can be determined to be the target user defined by the dimension factor, and the item to be detected (or a part of indexes of the item to be detected) is abnormal due to the anomaly of item resource acquisition data (including but not limited to item resource acquisition limits, item resource acquisition time and the like) of the target user. In this case, the resource allocation policy of the target user may be adjusted according to the project resource acquisition data of the target user, that is, the wind control policy or the operation policy may be adjusted for the target user.
In specific implementation, the abnormal detection data of the target user is determined based on the project resource acquisition data of the target user, and the method can be further implemented by the following steps:
determining a first difference value between the project resource acquisition data of the target user and a first resource value; and/or the presence of a gas in the gas,
determining a second difference value between the project resource acquisition data of the target user and a second resource value, and taking the first difference value and the second difference value as abnormal detection data of the target user;
the first resource value is a fixed resource value of the project to be detected, and the second resource value is an adjusted resource value generated based on the project data.
Further, determining an anomaly detection result of the item to be detected according to the anomaly detection rule corresponding to the item to be detected and the anomaly detection data, including:
determining a target resource value for carrying out anomaly detection according to the weights respectively corresponding to the first resource value and the second resource value;
determining an abnormal detection rule associated with the target resource value in the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether the target resource value is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
and if so, taking the dimension factor as an abnormal detection result of the item to be detected.
Specifically, after the target users associated with the dimension factors are screened according to the project data, the abnormal detection data of the target users can be determined based on the project resource acquisition data of the target users, and specifically, a first difference between the project resource acquisition data of the target users and a first resource value can be calculated based on the project resource acquisition data of the users; and/or determining a second difference value between the project resource acquisition data of the target user and a second resource value, and taking the first difference value and the second difference value as abnormal detection data of the target user;
the first resource value is a fixed resource value (a preset fixed value, which is kept unchanged) of the item to be detected, the second resource value is an adjusted resource value (which can be changed according to the change of the item data) generated based on the item data, and a second difference value between the item resource acquisition data and the second resource value can be used for representing relative change.
In specific implementation, an anomaly detection instruction submitted by a user aiming at the detection index of the item to be detected can be received, anomaly detection is carried out on the detection index according to the target dimension factor of the detection index carried in the anomaly detection instruction, and a corresponding anomaly detection result is generated and displayed.
Specifically, the anomaly detection platform can automatically detect an anomaly of the item to be detected and display a detection result to a user, and the user can issue an anomaly detection instruction to the anomaly detection platform under the condition that the anomaly of the item to be detected is determined according to the detection result, wherein the anomaly detection instruction carries a target dimensional factor of a detection index; and after receiving the anomaly detection instruction, the anomaly detection platform can perform anomaly detection on the detection index according to the target dimensional factor, and generates and displays a corresponding anomaly detection result.
In addition, after the abnormal detection result of the item to be detected is determined, if the abnormal item to be detected is determined according to the abnormal detection result, the dimension factor associated with the abnormal detection result is determined, and the dimension factor is used as a sub-dimension to be added to the item data.
One embodiment of the present specification obtains item data of at least two dimensions related to an item to be detected, where each dimension includes a plurality of sub-dimensions, combines the plurality of sub-dimensions of the at least two dimensions, uses a combination result as a dimension factor of the item to be detected, screens a target user associated with the dimension factor according to the item data, obtains data based on an item resource of the target user, determines abnormality detection data of the target user, and determines an abnormality detection result of the item to be detected according to an abnormality detection rule corresponding to the item to be detected and the abnormality detection data.
The embodiment of the specification realizes dimension crossing by combining a plurality of sub-dimensions under at least two dimensions, screens a target user based on a dimension factor generated by the dimension crossing, and performs anomaly detection on a to-be-detected item according to item resource acquisition data of the target user, so that the dimension factor which is difficult to disclose according to expert experience is favorably mined, and an heuristic anomaly detection result (anomaly attribution analysis result) is generated, thereby further being favorable for improving the anomaly detection result of the to-be-detected item.
The following will further describe the anomaly detection method in conjunction with fig. 3, taking the application of the anomaly detection method provided in this specification in a resource lending scenario as an example. Fig. 3 shows a flowchart of a processing procedure of an anomaly detection method according to an embodiment of the present specification, and specific steps include step 302 to step 320.
At step 302, project data for at least two dimensions associated with a resource loan project is obtained.
Wherein each dimension comprises a plurality of sub-dimensions.
Step 304, extracting project data under the target dimension.
And step 306, combining the multiple sub-dimensions under the target dimension, and taking the combined result as a dimension factor of the resource lending item.
And 308, screening target users associated with the dimension factors according to the project data under the target dimension.
In step 310, resource lending data of the target user is obtained from the project data of at least two dimensions.
Step 312, determining the abnormal detection data of the target user based on the resource lending data of the target user.
Step 314, determining an abnormal detection rule corresponding to the resource lending item, and determining an abnormal detection reference value corresponding to the abnormal detection rule.
Step 316, based on the anomaly detection rule, determines whether the resource variation value included in the anomaly detection data is greater than or equal to the anomaly detection reference value.
If yes, go to step 318; if not, determining that the resource lending item has no abnormity, and returning an abnormal detection result without abnormity.
Step 318, determining that the resource lending item has an abnormality, and using the dimension factor as an abnormality detection result of the resource lending item.
And step 320, adjusting the resource allocation strategy of the target user according to the resource lending data of the target user.
The embodiment of the specification realizes dimension crossing by combining a plurality of sub-dimensions under at least two dimensions, screens a target user based on a dimension factor generated by the dimension crossing, and performs abnormal detection on a resource lending item according to resource lending data of the target user, so that a mining part is facilitated to mine the dimension factor which is difficult to disclose according to expert experience, and an instructive abnormal detection result (abnormal attribution analysis result) is generated, thereby further facilitating to improve the abnormal detection result of the resource lending item.
Corresponding to the above method embodiment, the present specification further provides an abnormality detection apparatus embodiment, and fig. 4 shows a schematic diagram of an abnormality detection apparatus provided in an embodiment of the present specification. As shown in fig. 4, the apparatus includes:
an obtaining module 402, configured to obtain item data of at least two dimensions related to an item to be detected, where each dimension includes multiple sub-dimensions;
a combination module 404 configured to combine multiple sub-dimensions under the at least two dimensions, and take a combination result as a dimension factor of the item to be detected;
a screening module 406, configured to screen a target user associated with the dimension factor according to the project data, and determine abnormal detection data of the target user based on project resource acquisition data of the target user;
the determining module 408 is configured to determine an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
Optionally, the combining the multiple sub-dimensions of the at least two dimensions includes:
combining a plurality of sub-dimensions in any of the at least two dimensions; and/or the presence of a gas in the gas,
combining a plurality of sub-dimensions in any two or more of the at least two dimensions.
Optionally, the determining the abnormal detection data of the target user based on the project resource acquisition data of the target user includes:
determining a first difference value between the project resource acquisition data of the target user and a first resource value; and/or the presence of a gas in the gas,
determining a second difference value between the project resource acquisition data of the target user and a second resource value, and taking the first difference value and the second difference value as abnormal detection data of the target user;
the first resource value is a fixed resource value of the project to be detected, and the second resource value is an adjusted resource value generated based on the project data.
Optionally, the determining an abnormal detection result of the item to be detected according to the abnormal detection rule and the abnormal detection data corresponding to the item to be detected includes:
determining an abnormal detection rule corresponding to the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether a resource change value contained in the abnormal detection data is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
if so, determining that the item to be detected is abnormal, and taking the dimension factor as an abnormal detection result of the item to be detected.
Optionally, the determining an abnormal detection result of the item to be detected according to the abnormal detection rule and the abnormal detection data corresponding to the item to be detected includes:
determining a target resource value for carrying out anomaly detection according to the weights respectively corresponding to the first resource value and the second resource value;
determining an abnormal detection rule associated with the target resource value in the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether the target resource value is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
and if so, taking the dimension factor as an abnormal detection result of the item to be detected.
Optionally, the abnormality detection apparatus further includes:
receiving an abnormal detection instruction submitted by a user aiming at the detection index of the item to be detected;
performing anomaly detection on the detection index according to a target dimension factor of the detection index carried in the anomaly detection instruction;
and generating and displaying a corresponding abnormal detection result.
Optionally, before the acquiring the item data of at least two dimensions related to the item to be detected, the method further includes:
receiving a detection parameter configuration instruction submitted by a user aiming at the item to be detected, wherein the detection parameter configuration instruction comprises an abnormal detection time interval of the item to be detected;
polling and detecting whether the time difference between the current time and the historical abnormal detection time of the item to be detected is greater than or equal to the abnormal detection time interval or not according to a preset detection period;
and if so, executing the step of acquiring the project data of at least two dimensions related to the project to be detected.
Optionally, after determining the abnormal detection result of the item to be detected, the method further includes:
if the to-be-detected item is determined to be abnormal according to the abnormal detection result, determining a dimensionality factor associated with the abnormal detection result;
adding the dimension factor as a child dimension to the project data.
Optionally, after determining the abnormal detection result of the item to be detected, the method further includes:
and if the to-be-detected item is determined to be abnormal according to the abnormal detection result, acquiring data according to the item resource of the target user, and adjusting the resource allocation strategy of the target user.
The above is a schematic configuration of an abnormality detection apparatus of the present embodiment. It should be noted that the technical solution of the abnormality detection apparatus and the technical solution of the abnormality detection method described above belong to the same concept, and for details that are not described in detail in the technical solution of the abnormality detection apparatus, reference may be made to the description of the technical solution of the abnormality detection method described above.
FIG. 5 illustrates a block diagram of a computing device 500 provided in accordance with one embodiment of the present description. The components of the computing device 500 include, but are not limited to, a memory 510 and a processor 520. Processor 520 is coupled to memory 510 via bus 530, and database 550 is used to store data.
Computing device 500 also includes access device 540, access device 540 enabling computing device 500 to communicate via one or more networks 560. Examples of such networks include the Public Switched Telephone Network (PSTN), a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or a combination of communication networks such as the internet. The access device 540 may include one or more of any type of network interface, e.g., a Network Interface Card (NIC), wired or wireless, such as an IEEE802.11 Wireless Local Area Network (WLAN) wireless interface, a worldwide interoperability for microwave access (Wi-MAX) interface, an ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a bluetooth interface, a Near Field Communication (NFC) interface, and so forth.
In one embodiment of the present description, the above-described components of computing device 500, as well as other components not shown in FIG. 5, may also be connected to each other, such as by a bus. It should be understood that the block diagram of the computing device architecture shown in FIG. 5 is for purposes of example only and is not limiting as to the scope of the present description. Those skilled in the art may add or replace other components as desired.
Computing device 500 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., tablet, personal digital assistant, laptop, notebook, netbook, etc.), mobile phone (e.g., smartphone), wearable computing device (e.g., smartwatch, smartglasses, etc.), or other type of mobile device, or a stationary computing device such as a desktop computer or PC. Computing device 500 may also be a mobile or stationary server.
Wherein the memory 510 is configured to store computer-executable instructions and the processor 520 is configured to execute the following computer-executable instructions:
acquiring project data of at least two dimensions related to a project to be detected, wherein each dimension comprises a plurality of sub-dimensions;
combining a plurality of sub-dimensions under the at least two dimensions, and taking a combined result as a dimension factor of the item to be detected;
screening target users associated with the dimension factors according to the project data, acquiring data based on project resources of the target users, and determining abnormal detection data of the target users;
and determining an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
The above is an illustrative scheme of a computing device of the present embodiment. It should be noted that the technical solution of the computing device and the technical solution of the above-mentioned abnormality detection method belong to the same concept, and details that are not described in detail in the technical solution of the computing device can be referred to the description of the technical solution of the above-mentioned abnormality detection method.
An embodiment of the present specification also provides a computer readable storage medium storing computer instructions which, when executed by a processor, are used for implementing the steps of the anomaly detection method.
The above is an illustrative scheme of a computer-readable storage medium of the present embodiment. It should be noted that the technical solution of the storage medium belongs to the same concept as the technical solution of the above-mentioned abnormality detection method, and details that are not described in detail in the technical solution of the storage medium can be referred to the description of the technical solution of the above-mentioned abnormality detection method.
The foregoing description has been directed to specific embodiments of this disclosure. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.
The computer instructions comprise computer program code which may be in the form of source code, object code, an executable file or some intermediate form, or the like. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, and the like. It should be noted that the computer readable medium may contain content that is subject to appropriate increase or decrease as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer readable media does not include electrical carrier signals and telecommunications signals as is required by legislation and patent practice.
It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of acts, but those skilled in the art should understand that the present embodiment is not limited by the described acts, because some steps may be performed in other sequences or simultaneously according to the present embodiment. Further, those skilled in the art should also appreciate that the embodiments described in this specification are preferred embodiments and that acts and modules referred to are not necessarily required for an embodiment of the specification.
In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.
The preferred embodiments of the present specification disclosed above are intended only to aid in the description of the specification. Alternative embodiments are not exhaustive and do not limit the invention to the precise embodiments described. Obviously, many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the embodiments and the practical application, to thereby enable others skilled in the art to best understand and utilize the embodiments. The specification is limited only by the claims and their full scope and equivalents.

Claims (14)

1. An anomaly detection method comprising:
acquiring project data of at least two dimensions related to a project to be detected, wherein each dimension comprises a plurality of sub-dimensions;
combining a plurality of sub-dimensions under the at least two dimensions, and taking a combined result as a dimension factor of the item to be detected;
screening target users associated with the dimension factors according to the project data, acquiring data based on project resources of the target users, and determining abnormal detection data of the target users;
and determining an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
2. The anomaly detection method according to claim 1, said combining a plurality of sub-dimensions under said at least two dimensions comprising:
combining a plurality of sub-dimensions in any of the at least two dimensions; and/or the presence of a gas in the gas,
combining a plurality of sub-dimensions in any two or more of the at least two dimensions.
3. The anomaly detection method according to claim 1, said determining anomaly detection data of said target user based on project resource acquisition data of said target user, comprising:
determining a first difference value between the project resource acquisition data of the target user and a first resource value; and/or the presence of a gas in the gas,
determining a second difference value between the project resource acquisition data of the target user and a second resource value, and taking the first difference value and the second difference value as abnormal detection data of the target user;
the first resource value is a fixed resource value of the project to be detected, and the second resource value is an adjusted resource value generated based on the project data.
4. The anomaly detection method according to claim 1, wherein determining the anomaly detection result of the item to be detected according to the anomaly detection rule and the anomaly detection data corresponding to the item to be detected comprises:
determining an abnormal detection rule corresponding to the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether a resource change value contained in the abnormal detection data is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
if so, determining that the item to be detected is abnormal, and taking the dimension factor as an abnormal detection result of the item to be detected.
5. The anomaly detection method according to claim 3, wherein determining the anomaly detection result of the item to be detected according to the anomaly detection rule and the anomaly detection data corresponding to the item to be detected comprises:
determining a target resource value for carrying out anomaly detection according to the weights respectively corresponding to the first resource value and the second resource value;
determining an abnormal detection rule associated with the target resource value in the item to be detected, and determining an abnormal detection reference value corresponding to the abnormal detection rule;
judging whether the target resource value is greater than or equal to the abnormal detection reference value or not based on the abnormal detection rule;
and if so, taking the dimension factor as an abnormal detection result of the item to be detected.
6. The abnormality detection method according to claim 1, further comprising:
receiving an abnormal detection instruction submitted by a user aiming at the detection index of the item to be detected;
performing anomaly detection on the detection index according to a target dimension factor of the detection index carried in the anomaly detection instruction;
and generating and displaying a corresponding abnormal detection result.
7. The anomaly detection method according to claim 1, before acquiring item data of at least two dimensions related to an item to be detected, further comprising:
receiving a detection parameter configuration instruction submitted by a user aiming at the item to be detected, wherein the detection parameter configuration instruction comprises an abnormal detection time interval of the item to be detected;
polling and detecting whether the time difference between the current time and the historical abnormal detection time of the item to be detected is greater than or equal to the abnormal detection time interval or not according to a preset detection period;
and if so, executing the step of acquiring the project data of at least two dimensions related to the project to be detected.
8. The anomaly detection method according to claim 1, after determining the anomaly detection result of the item to be detected, further comprising:
if the to-be-detected item is determined to be abnormal according to the abnormal detection result, determining a dimensionality factor associated with the abnormal detection result;
adding the dimension factor as a child dimension to the project data.
9. The anomaly detection method according to claim 1, after determining the anomaly detection result of the item to be detected, further comprising:
and if the to-be-detected item is determined to be abnormal according to the abnormal detection result, acquiring data according to the item resource of the target user, and adjusting the resource allocation strategy of the target user.
10. An abnormality detection device comprising:
the system comprises an acquisition module, a display module and a display module, wherein the acquisition module is configured to acquire item data of at least two dimensions related to an item to be detected, and each dimension comprises a plurality of sub-dimensions;
the combination module is configured to combine the plurality of sub-dimensions under the at least two dimensions, and the combination result is used as a dimension factor of the item to be detected;
the screening module is configured to screen the target users related to the dimension factors according to the project data, acquire data based on project resources of the target users and determine abnormal detection data of the target users;
and the determining module is configured to determine an abnormal detection result of the item to be detected according to the abnormal detection rule corresponding to the item to be detected and the abnormal detection data.
11. An anomaly detection system comprising:
a data layer, an engine layer and an interaction layer;
the data layer is configured to acquire item data of at least two dimensions related to an item to be detected, wherein each dimension comprises a plurality of sub-dimensions;
the engine layer is configured to extract the item data from the data layer, combine a plurality of sub-dimensions under the at least two dimensions, use a combination result as a dimension factor of the item to be detected, screen a target user associated with the dimension factor according to the item data, acquire data based on item resources of the target user included in the item data, determine abnormal detection data of the target user, and determine a first detection result of the item to be detected according to an abnormal detection rule corresponding to the item to be detected and the abnormal detection data;
the interaction layer is configured to display the first detection result.
12. The anomaly detection system according to claim 11, said interaction layer being further configured to receive anomaly detection instructions submitted by a user for detection indexes of said items to be detected;
the engine layer is further configured to perform anomaly detection on the detection index according to a target dimension factor of the detection index carried in the anomaly detection instruction, and generate a second detection result;
the interaction layer is further configured to display the second detection result.
13. A computing device, comprising:
a memory and a processor;
the memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions to implement the steps of the anomaly detection method of any one of claims 1 to 9.
14. A computer readable storage medium storing computer instructions which, when executed by a processor, carry out the steps of the anomaly detection method of any one of claims 1 to 9.
CN202110830113.4A 2021-07-22 2021-07-22 Abnormality detection method, device and system Active CN113538130B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202110830113.4A CN113538130B (en) 2021-07-22 2021-07-22 Abnormality detection method, device and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202110830113.4A CN113538130B (en) 2021-07-22 2021-07-22 Abnormality detection method, device and system

Publications (2)

Publication Number Publication Date
CN113538130A true CN113538130A (en) 2021-10-22
CN113538130B CN113538130B (en) 2024-05-24

Family

ID=78120467

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202110830113.4A Active CN113538130B (en) 2021-07-22 2021-07-22 Abnormality detection method, device and system

Country Status (1)

Country Link
CN (1) CN113538130B (en)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105912699A (en) * 2016-04-25 2016-08-31 乐视控股（北京）有限公司 Data analysis method and device
CN108346011A (en) * 2018-05-15 2018-07-31 阿里巴巴集团控股有限公司 Index fluction analysis method and device
CN109684378A (en) * 2018-12-14 2019-04-26 北京向上一心科技有限公司 Data screening method, method for exhibiting data, device, equipment and storage medium
CN110119340A (en) * 2019-05-17 2019-08-13 北京字节跳动网络技术有限公司 Method for monitoring abnormality, device, electronic equipment and storage medium
CN110147945A (en) * 2019-04-30 2019-08-20 阿里巴巴集团控股有限公司 A kind of processing method of data fluctuations, device and equipment
CN111026570A (en) * 2019-11-01 2020-04-17 支付宝(杭州)信息技术有限公司 Method and device for determining abnormal reason of business system
CN112700252A (en) * 2021-03-25 2021-04-23 腾讯科技（深圳）有限公司 Information security detection method and device, electronic equipment and storage medium

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105912699A (en) * 2016-04-25 2016-08-31 乐视控股（北京）有限公司 Data analysis method and device
CN108346011A (en) * 2018-05-15 2018-07-31 阿里巴巴集团控股有限公司 Index fluction analysis method and device
CN109684378A (en) * 2018-12-14 2019-04-26 北京向上一心科技有限公司 Data screening method, method for exhibiting data, device, equipment and storage medium
CN110147945A (en) * 2019-04-30 2019-08-20 阿里巴巴集团控股有限公司 A kind of processing method of data fluctuations, device and equipment
CN110119340A (en) * 2019-05-17 2019-08-13 北京字节跳动网络技术有限公司 Method for monitoring abnormality, device, electronic equipment and storage medium
CN111026570A (en) * 2019-11-01 2020-04-17 支付宝(杭州)信息技术有限公司 Method and device for determining abnormal reason of business system
CN112700252A (en) * 2021-03-25 2021-04-23 腾讯科技（深圳）有限公司 Information security detection method and device, electronic equipment and storage medium

Also Published As

Publication number Publication date
CN113538130B (en) 2024-05-24

Similar Documents

Publication Publication Date Title
KR101864286B1 (en) Method and apparatus for using machine learning algorithm
CN109544163B (en) Risk control method, device, equipment and medium for user payment behavior
US20190036958A1 (en) Method and apparatus for generating cyber security threat index
CN111612165A (en) Predictive analysis platform
JP2019519027A (en) Learning from historical logs and recommending database operations on data assets in ETL tools
US20230419134A1 (en) Methods of explaining an individual predictions made by predictive processes and/or predictive models
CN111369344A (en) Method and device for dynamically generating early warning rule
CN115185760A (en) Abnormality detection method and apparatus
CN111738331A (en) User classification method and device, computer-readable storage medium and electronic device
CN111768230A (en) Label recommendation method and device for client portrait system and computer equipment
CN110555749A (en) credit behavior prediction method and device based on neural network
AU2021204470A1 (en) Benefit surrender prediction
CN112950218A (en) Business risk assessment method and device, computer equipment and storage medium
CN115204881A (en) Data processing method, device, equipment and storage medium
CA2976780C (en) Remote supervision of client device activity
CN109241249B (en) Method and device for determining burst problem
CN113538130A (en) Abnormity detection method, device and system
CN111291259B (en) Data screening method and device, electronic equipment and storage medium
CN115033891A (en) Vulnerability assessment method and device, storage medium and electronic equipment
CN115185606A (en) Method, device, equipment and storage medium for obtaining service configuration parameters
CN110472680B (en) Object classification method, device and computer-readable storage medium
CN112328937A (en) Information delivery method and device
CN111626887A (en) Social relationship evaluation method and device
CN115130623B (en) Data fusion method and device, electronic equipment and storage medium
CN111241477B (en) Method for constructing monitoring reference line, method and device for monitoring data object state

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant